Mountdev Ai Mcp Connector For Wordpress
Monthly
Missing Authorization in MountDev AI MCP Connector for WordPress (≤1.6.5) by Cascadia Web Services allows any authenticated low-privileged user to invoke plugin endpoints without proper capability checks, producing high integrity impact with no confidentiality or availability exposure. The root cause is CWE-862 (Missing Authorization), meaning the plugin registers REST or AJAX handlers that omit WordPress capability checks, permitting subscriber-level users to perform actions reserved for administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing Authorization in MountDev AI MCP Connector for WordPress (≤1.6.5) by Cascadia Web Services allows any authenticated low-privileged user to invoke plugin endpoints without proper capability checks, producing high integrity impact with no confidentiality or availability exposure. The root cause is CWE-862 (Missing Authorization), meaning the plugin registers REST or AJAX handlers that omit WordPress capability checks, permitting subscriber-level users to perform actions reserved for administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.